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CLAIMS 

What is claimed is: 

1. A method for monitoring user login activity for a server 
application, the method comprising: 

5 (a) receiving communication data between a server application and 

a client; 

(b) monitoring user login failures between the server application and 
the client during an established session; and 

(c) detecting when the number of user login failures exceeds a 
10 predetermined number. 

2. The method of claim 1, wherein the communication data is 
communicated over a network selected from the group consisting of a global 
communication network, a wide area network, a local area network, and a 

15 wireless network. 



3. The method of claim 1, wherein the communication data 
comprises an application protocol selected from the group consisting of 
hypertext transfer protocols, simple object access protocols, web distributed 
20 authoring and versioning protocols, simple mail transfer protocols, wireless 
application protocols, file transfer protocols, Internet message access 
protocols, post office protocols, web services protocols, simple mail transfer 
protocols, structured hypertext transfer protocols, and web-mail protocols. 

25 4. The method of claim 1 , wherein the communication data can 

comprise HTTP requests from the client and HTTP responses from the server 
application. 

5. The method of claim 1, wherein the server application is 
30 implemented by a web server. 
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6. The method of claim 1, wherein the client is implemented by a 
web-enabled device including a unique Internet protocol (IP) address. 

7. The method of claim 1, wherein the communication data 
comprises only transmission control protocol packets. 

8. The method of claim 1 , wherein the server application comprises 
a plurality of server applications. 

9. The method of claim 1 , wherein the monitored user login failures 
are associated with a single user account. 

1 0. The method of claim 1 , wherein the monitored user login failures 
are associated with a single Internet protocol (IP) address. 

11. A system for monitoring user login activity for a server application, 
the system comprising: 

(a) a network interface operable to receive communication data 
between a server application and a client; and 

(b) a detector operable to monitor user login failures between the 
server application and the client during an established session, 
and operable to detect when the number of user login failures 
exceeds a predetermined number. 

12. The system of claim 11, wherein the communication data is 
communicated over a network selected from the group consisting of a global 
communication network, a wide area network, a local area network, and a 
wireless network. 

13. The system of claim 11, wherein the communication data 
comprises an application protocol selected from the group consisting of 
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hypertext transfer protocols, simple object access protocols, web distributed 
authoring and versioning protocols, simple mail transfer protocols, wireless 
application protocols, file transfer protocols, Internet message access 
protocols, post office protocols, web services protocols, simple mail transfer 
5 protocols, structured hypertext transfer protocols, and web-mail protocols. 

14. The system of claim 11, wherein the communication data can 
comprise HTTP requests from the client and HTTP responses from the server 
application. 

10 

15. The system of claim 11, wherein the server application is 
implemented by a web server. 

16. The system of claim 1 1 , wherein the client is implemented by a 
15 web-enabled device including a unique Internet protocol (IP) address. 

17. The system of claim 11, wherein the communication data 
comprises only transmission control protocol packets. 

20 1 8. The system of claim 1 1 , wherein the server application comprises 

a plurality of server applications. 

1 9. The system of claim 1 1 , wherein the monitored user login failures 
are associated with a single user account. 

25 

20. A computer program product comprising computer-executable 
instructions embodied in a computer-readable medium for performing steps 
comprising: 

(a) receiving communication data between a server application and 
30 a client; 
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(d) monitoring user login failures between the server application and 
the client during an established session; and 

(e) detecting when the number of user login failures exceeds a 
predetermined number. 

5 

21. The computer program product of claim 20, wherein the 
communication data is communicated over a network selected from the group 
consisting of a global communication network, a wide area network, a local 
area network, and a wireless network. 

10 

22. The computer program product of claim 20, wherein the 
communication data comprises an application protocol selected from the group 
consisting of hypertext transfer protocols, simple object access protocols, web 
distributed authoring and versioning protocols, simple mail transfer protocols, 

1 5 wireless application protocols, file transfer protocols, Internet message access 
protocols, post office protocols, web services protocols, simple mail transfer 
protocols, structured hypertext transfer protocols, and web-mail protocols. 

23. The computer program product of claim 20, wherein the 
20 communication data can comprise HTTP requests from the client and HTTP 

responses from the server application. 

24. The computer program product of claim 20, wherein the server 
application is implemented by a web server. 

25 

25. The computer program product of claim 20, wherein the client is 
implemented by a web-enabled device including a unique Internet protocol (IP) 
address. 

30 26. The computer program product of claim 20, wherein the 

communication data comprises only transmission control protocol packets. 
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27. The computer program product of claim 20, wherein the server 
application comprises a plurality of server applications. 

28. The computer program product of claim 20, wherein the 
monitored user login failures are associated with a single user account. 

29. The computer program product of claim 20, wherein the 
monitored user login failures are associated with a single Internet protocol (IP) 
address. 



30. A method for monitoring user login activity for a server 
application, the method comprising: 

(a) receiving communication data between a server application and 
a client; 

1 5 (b) monitoring user login failures between the server application and 

the client during a predetermined time; and 
(c) detecting when the number of user login failures exceeds a 
predetermined number. 

20 31. The method of claim 30, wherein the communication data is 

communicated over a network selected from the group consisting of a global 
communication network, a wide area network, a local area network, and a 
wireless network. 

25 32. The method of claim 30, wherein the communication data 

comprises an application protocol selected from the group consisting of 
hypertext transfer protocols, simple object access protocols, web distributed 
authoring and versioning protocols, simple mail transfer protocols, wireless 
application protocols, file transfer protocols, Internet message access 

30 protocols, post office protocols, web services protocols, simple mail transfer 
protocols, structured hypertext transfer protocols, and web-mail protocols. 
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33. The method of claim 30, wherein the communication data can 
comprise HTTP requests from the client and HTTP responses from the server 
application. 

34. The method of claim 30, wherein the server application is 
implemented by a web server. 

35. The method of claim 30, wherein the client is implemented by a 
web-enabled device including a unique Internet protocol (IP) address. 

36. The method of claim 30, wherein the communication data 
comprises only transmission control protocol packets. 



37. A system for monitoring user login activity for a server application, 
15 the method comprising: 

(a) a network interface operable to receive communication data 
between a server application and a client; 

(b) a detector operable to monitor user login failures between the 
server application and the client during a predetermined time, 

20 and operable to detect when the number of user login failures 

exceeds a predetermined number. 

38. The system of claim 37, wherein the communication data is 
communicated over a network selected from the group consisting of a global 

25 communication network, a wide area network, a local area network, and a 
wireless network. 

39. The system of claim 37, wherein the communication data 
comprises an application protocol selected from the group consisting of 

30 hypertext transfer protocols, simple object access protocols, web distributed 
authoring and versioning protocols, simple mail transfer protocols, wireless 
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application protocols, file transfer protocols, Internet message access 
protocols, post office protocols, web services protocols, simple mail transfer 
protocols, structured hypertext transfer protocols, and web-mail protocols. 

5 40. The system of claim 37, wherein the communication data can 

comprise HTTP requests from the client and HTTP responses from the server 
application. 

41. The system of claim 37, wherein the server application is 
10 implemented by a web server. 

42. The system of claim 37, wherein the client is implemented by a 
web-enabled device including a unique Internet protocol (IP) address. 

15 43. The system of claim 37, wherein the communication data 

comprises only transmission control protocol packets. 

44. A computer program product comprising computer-executable 
instructions embodied in a computer-readable medium for performing steps 
20 comprising: 

(a) receiving communication data between a server application and 
a client; 

(b) monitoring user login failures between the server application and 
the client during a predetermined time; and 

25 (c) detecting when the number of user login failures exceeds a 

predetermined number. 



45. The computer program product of claim 44, wherein the 
communication data is communicated over a network selected from the group 
30 consisting of a global communication network, a wide area network, a local 
area network, and a wireless network. 
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46. The computer program product of claim 44, wherein the 
communication data comprises an application protocol selected from the group 
consisting of hypertext transfer protocols, simple object access protocols, web 
distributed authoring and versioning protocols, simple mail transfer protocols, 
wireless application protocols, file transfer protocols, Internet message access 
protocols, post office protocols, web services protocols, simple mail transfer 
protocols, structured hypertext transfer protocols, and web-mail protocols. 

47. The computer program product of claim 44, wherein the 
communication data can comprise HTTP requests from the client and HTTP 
responses from the server application. 

48. The computer program product of claim 44, wherein the server 
application is implemented by a web server. 

49. The computer program product of claim 44, wherein the client is 
implemented by a web-enabled device including a unique Internet protocol (IP) 
address. 

50. The computer program product of claim 44, wherein the 
communication data comprises only transmission control protocol packets. 

51. A method for monitoring user login activity for a server 
application, the method comprising: 

(a) - receiving communication data between a server application and 

an first authenticated user; 

(b) monitoring a login session between the server application and 
the first authenticated user during a time interval; and 

(c) detecting whether the first authenticated user logs into the server 
application as a second authenticated user during the time 
interval. 
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52. The method of claim 51, wherein the communication data is 
communicated over a network selected from the group consisting of a global 
communication network, a wide area network, a local area network, and a 
wireless network. 

5 

53. The method of claim 51, wherein the communication data 
comprises an application protocol selected from the group consisting of 
hypertext transfer protocols, simple object access protocols, web distributed 
authoring and versioning protocols, simple mail transfer protocols, wireless 

10 application protocols, file transfer protocols, Internet message access 
protocols, post office protocols, web services protocols, simple mail transfer 
protocols, structured hypertext transfer protocols, and web-mail protocols. 

54. The method of claim 51 , wherein the communication data can 
15 comprise HTTP requests from the client and a responses from the server 

application. 

55. The method of claim 51, wherein the server application is 
implemented by a web server. 

20 

56. The method of claim 51 , wherein the client is implemented by a 
web-enabled device including a unique Internet protocol (IP) address. 

57. The method of claim 51, wherein the communication data 
25 comprises only transmission control protocol packets. 

58. A system for monitoring user login activity for a server application, 
the method comprising: 

(a) a network interface operable to receive communication data 
30 between a server application and an first authenticated user; and 
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(b) a detector operable to monitor a login session between the 
server application and the first authenticated user during a time 
interval, and operable to detect whether the first authenticated 
user logs into the server application as a second authenticated 
5 user during the time interval. 

59. The system of claim 58, wherein the communication data is 
communicated over a network selected from the group consisting of a global 
communication network, a wide area network, a local area network, and a 

10 wireless network. 

60. The system of claim 58, wherein the communication data 
comprises an application protocol selected from the group consisting of 
hypertext transfer protocols, simple object access protocols, web distributed 

15 authoring and versioning protocols, simple mail transfer protocols, wireless 
application protocols, file transfer protocols, Internet message access 
protocols, post office protocols, web services protocols, simple mail transfer 
protocols, structured hypertext transfer protocols, and web-mail protocols. 

20 61. The system of claim 58, wherein the communication data can 

comprise HTTP requests from the client and HTTP responses from the server 
application. 

62. The system of claim 58, wherein the server application is 
25 implemented by a web server. 

63. The system of claim 58, wherein the client is implemented by a 
web-enabled device including a unique Internet protocol (IP) address. 

30 64. The system of claim 58, wherein the communication data 

comprises only transmission control protocol packets. 
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65. A computer program product comprising computer-executable 
instructions embodied in a computer-readable medium for performing steps 
comprising: 

(a) receiving communication data between a server application and 
a client; 

(b) monitoring user login failures between the server application and 
the client during a predetermined time; and 

(c) detecting when the number of user login failures exceeds a 
predetermined number. 

66. The computer program product of claim 65, wherein the 
communication data is communicated over a network selected from the group 
consisting of a global communication network, a wide area network, a local 
area network, and a wireless network. 

67. The computer program product of claim 65, wherein the 
communication data comprises an application protocol selected from the group 
consisting of hypertext transfer protocols, simple object access protocols, web 
distributed authoring and versioning protocols, simple mail transfer protocols, 
wireless application protocols, file transfer protocols, Internet message access 
protocols, post office protocols, web services protocols, simple mail transfer 
protocols, structured hypertext transfer protocols, and web-mail protocols. 

68. The computer program product of claim 65, wherein the 
communication data can comprise HTTP requests from the client and HTTP 
responses from the server application. 

69. The computer program product of claim 65, wherein the server 
application is implemented by a web server. 



-111- 



Attorney Docket No.: 1503/7 

- 112- 

70. The computer program product of claim 65, wherein the client is 
implemented by a web-enabled device including a unique Internet protocol (IP) 
address. 

71. The computer program product of claim 65, wherein the 
communication data comprises only transmission control protocol packets. 

72. A method for monitoring user logoff activity for a server 
application, the method comprising: 

(a) receiving communication data of a login session between a 
server application and a client; 

(b) monitoring user logoff between the server application and the 
client; 

(c) monitoring automatic session expiration between the server 
application and the client; and 

(d) determining whether the client completes logoff before the 
session automatically expires. 

73. The method of claim 72, wherein the communication data is 
communicated over a network selected from the group consisting of a global 
communication network, a wide area network, a local area network, and a 
wireless network. 

74. The method of claim 72, wherein the communication data 
comprises an application protocol selected from the group consisting of 
hypertext transfer protocols, simple object access protocols, web distributed 
authoring and versioning protocols, simple mail transfer protocols, wireless 
application protocols, file transfer protocols, Internet message access 
protocols, post office protocols, web services protocols, simple mail transfer 
protocols, structured hypertext transfer protocols, and web-mail protocols. 
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75. The method of claim 72, wherein the communication data can 
comprise HTTP requests from the client and HTTP responses from the server 
application. 

76. The method of claim 72, wherein the server application is 
implemented by a web server. 

77. The method of claim 72, wherein the client is implemented by a 

j 

web-enabled device including a unique Internet protocol (IP) address. 

78. The method of claim 72, wherein the communication data 
comprises only transmission control protocol packets. 

79. A system for monitoring user logoff activity for a server 
application, the method comprising: 

(a) a network interface operable to receive communication data of a 
login session between a server application and a client; 

(b) a detector operable to monitor user logoff between the server 
application and the client, operable to monitor automatic session 
expiration between the server application and the client, and 
operable to determine whether the client completes logoff before 
the session automatically expires. 

80. The system of claim 79, wherein the communication data is 
communicated over a network selected from the group consisting of a global 
communication network, a wide area network, a local area network, and a 
wireless network. 

81. The system of claim 79, wherein the communication data 
comprises an application protocol selected from the group consisting of 
hypertext transfer protocols, simple object access protocols, web distributed 
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authoring and versioning protocols, simple mail transfer protocols, wireless 
application protocols, file transfer protocols, Internet message access 
protocols, post office protocols, web services protocols, simple mail transfer 
protocols, structured hypertext transfer protocols, and web-mail protocols. 

5 

82. The system of claim 79, wherein the communication data can 
comprise HTTP requests from the client and HTTP responses from the server 
application. 

10 83. The system of claim 79, wherein the server application is 

implemented by a web server. 



84. The system of claim 79, wherein the client is implemented by a 
web-enabled device including a unique Internet protocol (IP) address. 

15 

85. The system of claim 79, wherein the communication data 
comprises only transmission control protocol packets. 

86. A computer program product comprising computer-executable 
20 instructions embodied in a computer-readable medium for performing steps 

comprising: 

(a) receiving communication data of a login session between a 
server application and a client; 

(b) monitoring user logoff between the server application and the 
25 client; 

(c) monitoring automatic session expiration between the server 
application and the client; and 

(d) determining whether the client completes logoff before the 
session automatically expires. 

30 
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87. The computer program product of claim 86, wherein the 
communication data is communicated over a network selected from the group 
consisting of a global communication network, a wide area network, a local 
area network, and a wireless network. 

5 

88. The computer program product of claim 86, wherein the 
communication data comprises an application protocol selected from the group 
consisting of hypertext transfer protocols, simple object access protocols, web 
distributed authoring and versioning protocols, simple mail transfer protocols, 

1 0 wireless application protocols, file transfer protocols, Internet message access 
protocols, post office protocols, web services protocols, simple mail transfer 
protocols, structured hypertext transfer protocols, and web-mail protocols. 

89. The computer program product of claim 86, wherein the 
15 communication data can comprise HTTP requests from the client and HTTP 

responses from the server application. 

90. The computer program product of claim 86, wherein the server 
application is implemented by a web server. 

20 

91 . The computer program product of claim 86, wherein the client is 
implemented by a web-enabled device including a unique Internet protocol (IP) 
address. 

25 92. The computer program product of claim 86, wherein the 

communication data comprises only transmission control protocol packets. 

93. A method for monitoring simultaneous logins for a server 
application, the method comprising: 
30 (a) monitoring a first user login session for a first user of a server 

application; 
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(b) monitoring a second user login session for a second user of the 
server application; and 

(c) determining whether the second user login session occurs during 
the first user login session when the user of the first and second 
login session are identical. 

94. The method of claim 93, comprising selectively generating an 
alert based upon whether the second user login session occurs during the first 
user login session when the user of the first and second login session are 
identical. 

95. The method of claim 93, wherein the first and second login 
sessions communicate over a network selected from the group consisting of a 
global communication network, a wide area network, a local area network, and 
a wireless network. 

96. The method of claim 93, wherein the communication data 
comprises an application protocol selected from the group consisting of 
hypertext transfer protocols, simple object access protocols, web distributed 
authoring and versioning protocols, simple mail transfer protocols, wireless 
application protocols, file transfer protocols, Internet message access 
protocols, post office protocols, web services protocols, simple mail transfer 
protocols, structured hypertext transfer protocols, and web-mail protocols. 

97. The method of claim 93, wherein the server application is 
implemented by a web server. 

98. The method of claim 93, wherein the client is implemented by a 
web-enabled device including a unique Internet protocol (IP) address. 
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99. A system for monitoring simultaneous logins for a server 
application, the method comprising: 

(a) a network interface operable to monitor communication data 
between a server application and a client; and 
5 (b) a detector operable to monitor a first user login session for a first 

user of the server application, operable to monitor a second user 
login session for a second user of the server application, and 
operable to determine whether the second user login session 
occurs during the first user login session when the user of the 
10 first and second login session are identical. 

100. The system of claim 99, wherein the detector is operable to 
selectively generating an alert based upon whether the second user login 
session occurs during the first user login session when the user of the first and 

15 second login session are identical. 

101. The system of claim 99, wherein the first and second login 
sessions communicate over a network selected from the group consisting of a 
global communication network, a wide area network, a local area network, and 

20 a wireless network. 

102. The system of claim 99, wherein the communication data 
comprises an application protocol selected from the group consisting of 
hypertext transfer protocols, simple object access protocols, web distributed 

25 authoring and versioning protocols, simple mail transfer protocols, wireless 
application protocols, file transfer protocols, Internet message access 
protocols, post office protocols, web services protocols, simple mail transfer 
protocols, structured hypertext transfer protocols, and web-mail protocols. 

30 103. The system of claim 99, wherein the server application is 

implemented by a web server. 
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104. The system of claim 99, wherein the client is implemented by a 
web-enabled device including a unique Internet protocol (IP) address. 

105. A computer program product comprising computer-executable 
instructions embodied in a computer-readable medium for performing steps 
comprising: 

(a) monitoring a first user login session for a first user of a server 
application; 

(b) monitoring a second user login session for a second user of the 
server application; and 

(c) determining whether the second user login session occurs during 
the first user login session when the user of the first and second 
login session are identical. 



106. The computer program product of claim 105, comprising 
selectively generating an alert based upon whether the second user login 
session occurs during the first user login session when the user of the first and 
second login session are identical. 



1 07. The computer program product of claim 1 05, wherein the first and 
second login sessions communicate over a network selected from the group 
consisting of a global communication network, a wide area network, a local 
area network, and a wireless network. 



108. The computer program product of claim 105, wherein the 
communication data comprises an application protocol selected from the group 
consisting of hypertext transfer protocols, simple object access protocols, web 
distributed authoring and versioning protocols, simple mail transfer protocols, 
wireless application protocols, file transfer protocols, Internet message access 
protocols, post office protocols, web services protocols, simple mail transfer 
protocols, structured hypertext transfer protocols, and web-mail protocols. 
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1 09. The computer program product of claim 1 05, wherein the server 
application is implemented by a web server. 

1 1 0. The computer program product of claim 1 05, wherein the client is 
implemented by a web-enabled device including a unique Internet protocol (IP) 
address. 

111. A method of monitoring logins for a server application, the method 
comprising: 

(a) designating a first login time for a client as a disallowed login 
time; 

(b) determining a second login time for the client in communication 
data with a server application; 

(c) determining whether the second login time matches the first login 
time; and 

(d) if the first and second login times match, indicating that the client 
in data communication with the server application is logging in at 
a disallowed login time. 

112. The method of claim 111, if the login time for the client is 
disallowed, generating an alert. 

113. The method of claim 111, wherein the server application 
communicates data over a network selected from the group consisting of a 
global communication network, a wide area network, a local area network, and 
a wireless network. 

114. The method of claim 111, wherein the communication data 
comprises an application protocol selected from the group consisting of 
hypertext transfer protocols, simple object access protocols, web distributed 
authoring and versioning protocols, simple mail transfer protocols, wireless 
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application protocols, file transfer protocols, Internet message access 
protocols, post office protocols, web services protocols, simple mail transfer 
protocols, structured hypertext transfer protocols, and web-mail protocols. 

5 115. The method of claim 111, wherein the data communicated with 

the server application can comprise HTTP requests from the client and HTTP 
responses from the server application. 

116. The method of claim 111, wherein the server application is 
10 implemented by a web server. 

117. The method of claim 111, wherein the client is implemented by a 
web-enabled device including a unique Internet protocol (IP) address. 

15 118. The method of claim 111, wherein the data communicated with 

the server application comprises only transmission control protocol packets. 

119. A system for monitoring logins for a server application, the 
method comprising: 

20 (a) a network interface operable to monitor communication data 

between a server application and a client; and 
(b) a detector operable to designate a first login time for a client as a 
disallowed login time, operable to determine a second login time 
for the client in communication data with a server application, 

25 operable to determine whether the second login time matches 

the first login time, and operable to indicating that the client in 
data communication with the server application is logging in at a 
disallowed login time, if the first and second login times match. 

30 120. The system of claim 119, wherein the detector is operable to 

generate an alert if the login time for the client is disallowed. 
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121. The system of claim 119, wherein the server application 
communicates data over a network selected from the group consisting of a 
global communication network, a wide area network, a local area network, and 
a wireless network. 

5 

122. The system of claim 119, wherein the communication data 
comprises an application protocol selected from the group consisting of 
hypertext transfer protocols, simple object access protocols, web distributed 
authoring and versioning protocols, simple mail transfer protocols, wireless 

10 application protocols, file transfer protocols, Internet message access 
protocols, post office protocols, web services protocols, simple mail transfer 
protocols, structured hypertext transfer protocols, and web-mail protocols. 

123. The system of claim 119, wherein the data communicated with 
1 5 the server application can comprise HTTP requests from the client and HTTP 

responses from the server application. 

124. The system of claim 119, wherein the server application is 
implemented by a web server. 

20 

1 25. The system of claim 119, wherein the client is implemented by a 
web-enabled device including a unique Internet protocol (IP) address. 

126. The system of claim 119, wherein the data communicated with 
25 the server application comprises only transmission control protocol packets. 

127. A computer program product comprising computer-executable 
instructions embodied in a computer-readable medium for performing steps 
comprising: 

30 (a) designating a first login time for a client as a disallowed login 

time; 
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(b) determining a second login time for the client in data 
communication with a server application; 

(c) determining whether the second login time matches the first login 
time; and 

5 (d) if the first and second login times match, indicating that the client 

in data communication with the server application is logging in at 
a disallowed login time. 

1 28. The computer program product of claim 1 27, if the login time for 
10 the client is disallowed, generating an alert. 

129. The computer program product of claim 127, wherein the server 
application communicates data over a network selected from the group 
consisting of a global communication network, a wide area network, a local 

15 area network, and a wireless network. 

130. The computer program product of claim 127, wherein the 
communication data comprises an application protocol selected from the group 
consisting of hypertext transfer protocols, simple object access protocols, web 

20 distributed authoring and versioning protocols, simple mail transfer protocols, 
wireless application protocols, file transfer protocols, Internet message access 
protocols, post office protocols, web services protocols, simple mail transfer 
protocols, structured hypertext transfer protocols, and web-mail protocols. 

25 131 . The computer program product of claim 127, wherein the data 

communicated with the server application can comprise HTTP requests from 
the client and HTTP responses from the server application. 

1 32. The computer program product of claim 1 27, wherein the server 
30 application is implemented by a web server. 
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1 33. The computer program product of claim 1 27, wherein the client is 
implemented by a web-enabled device including a unique Internet protocol (IP) 
address. 

134. The computer program product of claim 127, wherein the data 
communicated with the server application comprises only transmission control 
protocol packets. 
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